Address translation affects multiple layers
NAT changes network addressing, while SIP and SDP can also carry addresses inside signaling. A translated packet source does not automatically correct every application-level address. This is why call setup can work while incoming delivery or audio fails.
10.0.0.10 is an illustrative private address. Both directions traverse the NAT/firewall; signaling success does not validate SDP media reachability.
Draw both participants
Identify whether the PBX, phone or both are behind NAT. Record which side initiates communication and whether media is relayed. A solution for an office PBX behind a router may not suit a public VPS with remote phones.
Inspect the failed direction
For registration or incoming calls, review contact and response routing. For missing sound, inspect SDP and actual media destinations. Use the PBX's topology-specific settings and carrier guidance, then review the matching firewall policy.
Avoid universal fixes
Broad port forwarding, indiscriminate SIP ALG changes and copying every NAT option can introduce new problems. Make one evidence-supported change and re-test internal, outside and transferred calls. A VPN changes the reachable topology and should trigger a fresh review of earlier NAT workarounds.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.